Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in Metabase, an open-source business intelligence platform, allows authorized users to read or write arbitrary files on the server. This could potentially expose sensitive data or allow unauthorized modifications. The issue is present when using the H2 data source and is enabled by default with the sample database.
- Unauthorized file access on servers.
- Critical issue affecting data security and integrity.
- Confirm Metabase H2 data source relevance.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by leveraging authorized access to Metabase's native query or action features against an H2 data source. This allows the attacker to bypass restrictions and use built-in functions to read or write arbitrary files on the server, or even link to other databases. Since the default sample database uses H2, this vulnerable path is exposed out-of-the-box.
- Requires authorized query access.
- Triggers via native queries or actions.
- Allows arbitrary file access on server.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, users authorized to run native queries or actions could leverage built-in functions to read or write arbitrary files on the Metabase server or link other databases. This is because native queries against an H2 data source are passed through without restriction on host-facing built-in functions. The default sample database uses H2, exposing this vulnerability by default.
- Server files could be read or written.
- Unauthorized functions could be invoked.
- Arbitrary file access on the server.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners responsible for Metabase instances and the platform teams managing the underlying infrastructure are likely to be involved. The first practical step is to identify all deployed Metabase instances, confirm their network reachability, and assess their criticality to business operations. Once accountable owners are identified, remediation efforts can be planned based on the assessed risk.
- Platform and application teams should own the issue.
- Verify Metabase instance reachability and business criticality.
- Plan and execute remediation based on risk.
